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© A cable television converter with remotely modi- 
fiable functionality receives firmware downloaded 
over a cable television network. The integrity of the 
firmware is verfied and if valid, the firmware is ex- 
ecuted to provide one or more converter funtions. If 
the firmware is invalid, default operation software 
contained in ROM is executed instead of the firm- 
ware to return the converter to baseline operation. In 
one embodiment, the converter includes a frequency 
agile data receiver to receive control instructions on 
a first data channel and firmware on a second data 
channel. The receiver is forced back to the first 
^channel if a successful firmware download does not 
^ occur on the second channel within a predetermined 
Qtime period. The firmware is continuously transmit- 
©ted ' n short segments, and the converter can con- 
^Itinue to receive segments until all the segments of a 
designated firmware package have been success- 
or fully downloaded, unless the predetermined time lim- 
Wit expires sooner. 
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are provided for verifying the integrity of the firm- 
ware, and processor means coupled to the storing 
means accesses and executes the firmware to pro- 
vide one or more converter functions dictated by 
the firmware. Nonvolatile memory means are coup- 
led to the processor means for storing default 
operation software for the converter. Means re- 
sponsive to the verifying means cause the proces- 
sor means to execute the default operation soft- 
ware, instead of the downloaded firmware, in the 
event the integrity of the firmware is not verified. 

Data receiving means may be provided for 
obtaining instructions downloaded over a cable 
television network. Downloaded firmware is re- 
ceived and stored by the converter only in re- 
sponse to specific instructions received by the data 
receiving means. 

The firmware receiving means and data receiv- 
ing means can comprise a frequency agile data 
receiver, together with means for selectively tuning 
the receiver, to receive instructions on a first chan- 
nel and downloaded firmware on a second channel. 
Timer means return the receiver to the first channel 
if the receiver has been tuned to the second chan- 
nel for a predetermined time period. The predeter- 
mined time period may be specified in instructions 
received on said first channel, and the length of the 
time period may be dependent on an amount of 
firmware to be received. In this manner, a con- 
verter will not become stuck on the second channel 
by error, and be rendered unable to receive further 
instructions on the first channel. 

The downloaded firmware received and stored 
by the converter can implement a functional layout 
on a keyboard associated with the converter. Firm- 
ware can also implement a feedback function, such 
as an LED (light-emitting-diode) display or on- 
screen display to assist a user in operating the 
converter. A control function for a video recorder 
coupled to the converter can also be implemented 
by the firmware. Similarly, the firmware can imple- 
ment a communication protocol for the converter, a 
descrambling technique for the converter, an on- 
screen display to be provided by the converter to a 
television coupled thereto, and/or a user interface 
to services provided over the cable television net- 
work. 

In a preferred embodiment of the present in- 
vention, firmware is transmitted in an encrypted 
form, and the instructions contain a key for decryp- 
ting the firmware. The firmware may also be re- 
ceived by the converter in a plurality of segments, 
with the instructions identifying the number of seg- 
ments to be received for a complete firmware 
download. Means can be provided for determining 
if ail of the segments have been validly received, 
and for receiving replacement segments if one or 
more segments of the firmware have not been 
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validly received. Receipt of firmware can be pre- 
vented if the number of segments identified by the 
instructions is greater than a predetermined limit. 
Cable television headend apparatus is provided 

5 for downloading firmware to an addressable, re- ■ 
motely modifiable cable television converter. 
Means are provided for transmitting addressable 
converter data on a first data channel of a cable 
television network. Means are provided for trans- 

70 mitting firmware on a second data channel of the 
cable television network. An address specific to a 
particular converter is provided in the addressable 
converter data, which enables specific data to be 
received by the converter. Instructions are provided 

75 in the specific data, to cause the converter to 
receive firmware transmitted on the second chan- 
nel. 

The cabie television headend apparatus can 
further include means for verifying that firmware 

20 downloaded to the converter has been successfully 
received by the converter. Billing means maintain 
records of the cable television services each con- 
verter on the system is authorized to receive, and 
the various functions the converter is to have, and 

25 can assign a particular firmware package to be 
downloaded to a particular converter on the basis 
of the functions specified for that converter. 

A method for providing a cable television con- 
verter with functions dictated by downloaded firm- 

30 ware is also provided. Converter control data is 
received from a remote location via a cable televi- 
sion network. A designated firmware package is 
captured from a set of firmware packages carried 
on the cable television network, in response to 

35 instructions contained in the converter control data. 
The designated firmware package is stored in a 
memory provided in the converter, and is executed 
to provide at least one converter function dictated 
thereby. 

40 The firmware packages may be carried on the 

cable television network in encrypted form, and 
decrypted using a key contained in the converter 
control data. In one embodiment the converter 
control data is received on a first data channel and 

45 the firmware packages are captured from a second 
data channel on the cable television network. The 
first channel is monitored to receive converter con- 
trol data, and the second channel is tuned to cap- 
ture firmware upon receipt of appropriate instruc- 

50 tions on the first channel. Reception is returned to 
the first channel after the firmware is captured. If 
the firmware has not been captured within a pre- 
determined time period, reception switched back to 
the first channel from the second channel. 

55 Also in accordance with the present invention, 

a remotely modifiable user terminal is provided 
which comprises means for receiving a plurality of 
cyclically transmitted firmware segments, the seg- 

3 
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may optionally be provided via tap 32 for receipt of 
data from converter 40 by addressable controller 
14. Such data might include, for example, a ver- 
ification that converter 40 has successfully received 
a firmware package it has been instructed to re- 
ceive. The provision of a return path 28, which 
provides a "two-way" cable communication sys- 
tem, is well known in the art. 

Billing system 22 is provided at the headend 
for maintaining accounting information relating to 
charges incurred by subscribers on the cable sys- 
tem. In accordance with the present invention, dif- 
ferent firmware packages downloaded by headend 
10 to converter 40 may provide different converter 
functions, with higher levels of service providing 
increased converter functionality. Billing system 22 
keeps track of the level or service for. each sub- 
scriber, and assigns particular firmware packages 
to subscriber converters on the basis of converter 
functionality to be provided to each subscriber. 

At the subscriber location 12, a subscriber may 
have one or more video appliances 42, 44 coupled 
to the output of converter 40. For example, video 
appliance 42 might be a television set, and video 
appliance 44 might be a video recorder ("VCR"). In 
accordance with the present invention, firmware 
downloaded to converter 40 can provide functions 
relating to a VCR. An example of such a function is 
time controlled programming. This function enables 
the converter to be programmed to make channel 
changes at various times so that the VCR can 
record different television programs on different 
channels automatically and while unattended. Such 
a function can also enable "impulse pay-per-view" 
orders to be programmed into the converter by a 
subscriber, so that special premium programs can 
be ordered, when the subscriber is not home, and 
recorded on the subscriber's VCR for later viewing. 

Figure 2 is a block diagram illustrating the 
pertinent components in one embodiment of a con- 
verter 40 in accordance with the present invention. 
In the embodiment illustrated, the converter re- 
ceives addressable data on one data channel and 
downloaded firmware on another data channel. It is 
noted that in another embodiment of the invention, 
both the addressable data and the firmware can be 
received over a single data channel. Or, the firm- 
ware may be carried on some other media, such as 
the public telephone network. 

In the two channel embodiment illustrated in 
Figure 2, a microprocessor 50 receives data from 
cable 36 via a frequency agile receiver 52. A 
transmitter 61 and return path 62 can be provided 
from microprocessor 50 back to addressable con- 
troller 14 in the event the converter is used with a 
two-way cable television system. Like receiver 52, 
transmitter 61 can be frequency agile to enable a 
choice of return transmission frequencies. 
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A tuner 54, under the control of microprocessor 
50, tunes frequency agile receiver 52 to either a 
primary channel for receipt of addressable data 
(e.g., instructions to capture a particular firmware 

5 package) or to a secondary channel for the receipt 
of firmware. Although a single secondary channel is 
described herein for purposes of illustration, it will 
be appreciated that any number of such secondary 
channels can be provided, depending on system 

w requirements. Typically, frequency agile receiver 
will be tuned to the primary channel, and will only 
switch to the secondary channel upon specific 
instructions contained in data received on the first 
channel. In the alternate embodiment where both 

15 addressable data and firmware are received on a 
single data channel, frequency agile receiver 52 
and tuner 54 can be replaced with a fixed fre- 
quency data receiver. 

The provision of a dedicated secondary data 

20 channel as illustrated in Figure 2 is advantageous. 
By keeping firmware data off of the primary chan- 
nel, the data throughput load on this channel is 
reduced. 

In the two channel embodiment, firmware data 

25 is broadcast cyclically on the second channel, by 
addressable controller 14 at the headend. In a 
preferred embodiment, a plurality of different firm- 
ware packages are broadcast on the secondary 
channel, each package providing different convert- 

30 er functions or combinations of functions. Upon 
receipt of instructions on the primary channel, 
microprocessor 50 will cau(e tuner 54 to switch 
receiver 52 to the secondary channel for receipt of 
a designated firmware package. 

35 Various memory devices are coupled to micro- 

processor 50. including read only memory 
("ROM") 56, operating random access memory 
("RAM") 58, and nonvolatile firmware RAM 60. 
ROM 56 contains a program that allows converter 

40 40 to retrieve and execute a downloaded firmware 
package. Upon receiving the proper command from 
the addressable controller, the converter aborts any 
downloaded package currently being executed, ac- 
cesses the appropriate data channel for receipt of a 

45 designated firmware package to be downloaded, 
and receives and loads the firmware into non- 
volatile firmware RAM 60. 

ROM 56 also contains default operation soft- 
ware, which is used to restore the converter to a 

so nominal or "baseline" operation if a bad firmware 
download occurs. As explained below, if an error is 
detected in the receipt of downloaded firmware, or 
if the firmware is found to be invalid, the converter 
is forced to execute only the default operation 

55 software stored in ROM 56. 

A timer 64 is associated with microprocessor 
50 to provide a time-out feature that prevents the 
converter from getting stuck on the secondary 

5 
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downloadable firmware. Utility meter reading can 
also be provided, by adding an asynchronous data 
port to the converter and controlling the retrieval of 
utility data via downloaded firmware.. 

A flowchart illustrating a routine which can be 
used by the addressable controller in connection 
with the receipt and downloading of firmware is 
provided in Figure 3. The routine begins at box 80, 
and at box 82 a determination is made as to 
whether a firmware update has been received from 
the firmware development system. If so, control 
passes to box 84 and the new firmware data is 
encrypted. At box 86, the encrypted data is loaded 
into the secondary data channel transmitter 
(firmware modulator 24) and continuously transmit- 
ted on the secondary channel together with other 
firmware packages that can be provided to convert- 
ers on the system. 

At box 88, a determination is made as to 
whether a new firmware package assignment has 
been made by billing system 22. If so, addressable 
controller 14 sends an appropriate command on 
the primary channel (control data modulator 26) as 
indicated at box 90. The command is addressed to 
the particular converter that is to receive the firm- 
ware, and identifies the channel the firmware is to 
be received from, identifies the firmware package 
to be received, provides the decryption key neces- 
sary to decrypt the firmware data, identifies the 
number of segments which make up the complete 
firmware package, and sets forth the time-out pa- 
rameter defining the maximum time the converter 
should stay tuned to the secondary channel for 
receipt of the downloaded firmware. 

The converter receives the firmware in fixed 
length "segments", and specific converter models 
will have specific maximum segment numbers de- 
termining the actual maximum size of allowable 
firmware downloads. In a preferred embodiment, 
the maximum segment number is a hard-coded 
parameter. Should an attempt be made to down- 
load firmware that exceeds the maximum size, the 
download will be rejected by the converter. In op- 
eration, the converter will ignore the download 
command and will not switch to the secondary 
channel if the transmitted maximum segment num- 
ber parameter exceeds the internal converter maxi- 
mum. 

At box 92 of Figure 3, a determination is made 
as to whether an abort of a download is required. 
This would be the case, for example, if the addres- 
sable controller detects a problem with an attempt- 
ed download. In the event an abort is required, an 
abort command is transmitted over the secondary 
channel as indicated at box 94. The converter will 
then switch back to the primary channel, execute 
the default operation software to return to a 
baseline operation, and await a subsequent com- 
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mand from the addressable controller via the pri- 
mary data channel. At box 96, the routine of Figure 
3 ends. It will be appreciated by those skilled in the 
art that the routine of Figure 3 is called on a 

s periodic basis (or can be a continuous loop) to 
enable new firmware to be received from the firm- 
ware development system and to download firm- 
ware packages to converters at the command of 
billing system 22. 

70 Figure 4 illustrates a routine that the addres- 

sable controller can use to continuously transmit 
firmware data over the secondary channel. The 
routine commences at box 100, and at box 102 
data is transmitted over the secondary channel. At 

75 box 104, a determination is made as to whether the 
last segment of a firmware package has been 
transmitted. If not, transmission of the remaining 
segments continues as indicated at box 102. Once 
the last segment has been transmitted, control 

20 passes to box 106 and the addressable controller 
transmits a check/execute command to the 
converter(s) that was to receive the firmware pack- 
age. The check/execute command includes the fir- 
mware package number that was to be received, 

25 and a check pattern. The check pattern is used to 
verify the entire download prior to execution. When 
a check/execute command is received, the con- 
verter checks to see if all required segments have 
been received, and that the check pattern down- 
so loaded matches the pattern calculated from the 
actual downloaded data, if all checks are valid, the 
converter permits execution of the downloaded 
code, and returns to the primary data channel. 
After the check/execute command is sent at box 

35 106 of Figure 4, control returns to box 102, and 
continuous transmission of the data proceeds over 
the secondary channel. 

Figure 5 is a flowchart illustrating the capture 
of downloaded firmware by a converter. The rou- 

40 tine begins at box 110, and control passes to box 
112 where a determination is made as to whether a 
firmware capture command has been sent to the 
converter. If not, the converter continuously waits 
for such a command to be received at box 112. 

45 Once a firmware capture command is received, 

control passes from box 112 to box 120 for the 
actual capture of the firmware. At the same time, 
an ancillary time-out process commences as in- 
dicated at boxes 114, 116, and 118. A timer counts 

so down the time-out period specified in the firmware 
capture command. If the time-out period expires 
before the specified firmware package has been 
successfully captured, as determined at box 114, 
control passes to box 116 where the download is 

55 aborted and the converter returns to the primary 
data channel. As indicated at box 118, the default 
operation software is executed so that the con- 
verter can operate in a baseline mode until the 

7 
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Send Firmware Check Pattern 

The "Accept Firmware Download" command is 
used to initiate the firmware download process. It 
may be sent to one individual converter or globally 
to a set of converters that understand a group 
address. The addressed converter(s) prepares to 
accept the package number, on the appropriate 
channel, using the given firmware decryption key 
and maximum segment number. The firmware 
download time-out value is also given. Upon recep- 
tion of this command, the converter goes into its 
firmware download mode, in which it must not 
execute any downloaded code. 

The "Return to Primary Channel" command is 
used to force a converter to return to the primary 
data channel. This command may also be sent in a 
specific format to an individual converter, or in 
group format to a set of converters. All converters 
receiving this command abort the current firmware 
download, clear their firmware segment bit maps, 
and exit the firmware download mode. 

The "Disallow Dowloaded Execution" com- 
mand explicitly disallows the execution of any 
downloaded firmware. It may be sent in the specific 
or group format. All converters receiving this com- 
mand abort execution of any downloaded firmware, 
clear their firmware segment bit maps, exit firm- 
ware download mode, and execute the default op- 
eration software contained in ROM for baseline 
operation. Another method of prohibiting download- 
ed firmware from being executed is to send an 
"Accept Firmware Download" command immedi- 
ately followed by a "Return to Primary Channel" 
command. 

The "Load Firmware Segment" command is 
used to download the individual segments of a 
firmware package. All converters receiving this 
command, if in firmware reception mode, overwrite 
the appropriate segment of firmware by the re- 
ceived data. Before actually overwriting the code, 
the converter checks to see if the package number 
matches the commanded package number, and 
calculates the segment check pattern from the re- 
ceived data, if the check pattern is correct, the 
segment data is decrypted, the appropriate prior 
segment is overwritten with the new segment, and 
the appropriate bit in the firmware segment bit map 
is set. 

The "Check/Execute Firmware" command is 
used to terminate the firmware download process. 
All converters receiving this command respond 
only if the package number matches the one sent 
originally in the "Accept Firmware Download" com- 
mand, and if in firmware reception mode. If so, the 
converter checks to see if all of the necessary 
segments of firmware have been correctly re- 
ceived. If they, have been, the package check pat- 
tern is calculated and tested. If the check pattern is 
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bad, the converter ignores the command. If the 
check pattern is good, the converter permits execu- 
tion of the newly downloaded package, switches 
back to the primary data stream, exits the firmware 

5 download mode, and clears its firmware download 
segment bit map. 

The "Send Firmware Check Pattern" command 
is used to verify the firmware download process. A 
converter receiving this command responds only if 

w it is not in firmware reception mode. In this event, 
the converter reports the check pattern of the ap- 
propriate segment or of the entire package. This 
verification scheme is only available on a two-way 
cable system. 

75 Figure 6 illustrates a periodic self-check routine 

used by the converter to test the validity of down- 
loaded firmware to ensure that it has not changed 
since the last download. This self-check is per- 
formed by the converter itself, and no addressable 

20 controller command is required to initiate it. The 
routine begins at box 150. At box 152, a clock runs 
to keep track of time. At box 154, a determination 
is made as to whether a predetermined time inter- 
val has passed. If not, the routine loops back to 

25 box 152 and the process continues until the time 
interval has run. Then, box 154 passes control to 
box 156 to commence the periodic self-check. 

At box 156, the first segment of the firmware 
package is tested by computing its checksum. At 

30 box 1 58, a determination is made as to whether the 
checksum is the proper checksum for that seg- 
ment. If not, control passes to box 160 and the 
default operation software is executed to return the 
converter to baseline operation. If the checksum for 

35 the segment is proper, control passes to box 162, 
which determines if the segment just tested is the 
last segment in the firmware package. If not, the 
routine loops back to box 156 so that ail of the 
segments in the firmware package can be tested. 

40 Once the last segment has been tested, control 

is passed from box 1 62 to box 1 64 where the clock 
is reset. Control then loops back, to box 1 52 and 
the process continues, so that the self-check will 
be periodically performed at the time interval dic- 

45 tated by the time-out determination function at box 
154. 

It will now be appreciated that the present 
invention provides a method and apparatus for 
remotely modifying the functionality of a terminal, 

50 such as a cable television converter. Terminal func- 
tions are dictated by downloaded firmware. The 
firmware is transmitted in small segments to re- 
duce the likelihood and severity of transmission 
errors, and to reduce the temporary buffering re- 

55 quirements within the terminal. Each section of a 
firmware package is transmitted with an identifier 
indicating which segment it is, and which firmware 
package it is part of. A multiplicity of firmware 

9 
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frequency agile data receiver means for receipt of 
addressable data from a cable television headend 
on a first channel and for receipt of firmware from 
said headend on a second channel; 
means for tuning said receiver means to said sec- 
ond channel for receipt of firmware in response to 
instructions contained in addressable data received 
on said first channel; 

memory means for storing firmware received on 
said second channel; and 

processor means coupled to said memory means 
for accessing and executing firmware received 
from said headend to provide at least one con- 
verter function. 

21. The converter of claim 20 further compris- 
ing: 

means for verifying the integrity of firmware re- 
ceived on said second channel; and 
means for causing said processor means to ex- 
ecute default operation software instead of said 
firmware in the event the integrity of said firmware 
is not verified. 

22. The converter as defined in one of claims 
or 21 further comprising: 

timer means for returning said receiver to said first 
channel if it has been tuned to said second channel 
for a predetermined time period. 

23. The converter of claim 22 wherein said 
predetermined time period is specified in instruc- 
tions contained in addressable data received on 
said first channel. 

24. The converter as defined in one of claims 
22 or 23 wherein the length of said predetermined 
time period is dependent on the amount of firm- 
ware to be received. 

25. The converter as defined in one of claims 
20-24 wherein said firmware implements a func- 
tional layout on a keyboard associated with said 
converter. 

26. The converter as defined in one of claims 
20-24 wherein said firmware implements a feed- 
back function to assist a user in operating the 
converter. 

27. The converter as defined in one of claims 
20-24 wherein said firmware implements a control 
function for a video recorder coupled to the con- 
verter. 

28. The converter as defined in one of claims 
20-24 wherein said firmware implements a commu- 
nication protocol for the converter. 

29. The converter as defined in one of claims 
20-24 wherein said firmware implements a de- 
scrambling technique for the converter. 

30. The converter as defined in one of claims 
20-24 wherein said firmware implements an on- 
screen display to be provided by the converter to a 
television coupled thereto. 

31. The converter as defined in one of claims 
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20-24 wherein said firmware implements a user 
interface to services provided over a cable televi- 
sion network. 

32. The converter as defined in one of claims 
5 20-24 wherein said firmware implements an elec- 
tronic mail capability to be provided over a cable 
television network. 

33. The converter as defined in one of claims 
20-24 wherein said firmware implements a viewer- 

w ship monitoring function. 

34. Cable television headend apparatus for 
downloading firmware to an addressable remotely 
modifiable cable television converter, comprising: 
means for transmitting addressable converter data 

15 on a first data channel of a cable television net- 
work; 

means for transmitting firmware on a second data 

channel of said cable television network; 

means for providing an address in said addres- 

20 sable converter data specific to a particular con- 
verter coupled to the network, said address en- 
abling specific data to be received by said con- 
verter on said first data channel; and 
means for providing instructions in said specific 

25 data, said instructions causing said converter to 
receive firmware transmitted on said second chan- 
nel. 

35. The apparatus of claim 34 further compris- 
ing: 

30 means for verifying that firmware downloaded to 
said converter has been successfully received by 
the converter. 

36. The apparatus as defined in one of claims 
34 or 35 further comprising: 

35 billing means for maintaining a record of functions 
said converter is authorized to have, and for as- 
signing a particular firmware package to be down- 
loaded to said converter on the basis of the au- 
thorized functions. 

40 37. A method for providing a cable television 

converter with functions dictated by downloaded 
firmware, comprising the steps of: 
receiving converter control data from 3 remote 
headend location; 

45 capturing a designated firmware package, from a 
set of firmware packages transmitted from said 
remote headend location, in response to instruc- 
tions contained in said converter control data; 
storing the designated firmware package in a mem- 

so ory provided in said converter; and 

executing said firmware to provide at least one 
converter function dictated thereby. 

38. The method of claim 37 wherein the firm- 
ware packages are transmitted in encrypted form, 

55 said method comprising the further step of: 

decrypting the captured firmware using a key con- 
tained in said converter control data. 

39. The method as defined in one of claims 37 
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© Functionally modifiable cable television converter system. 



© A cable television converter with remotely modi- 
fiable functionality receives firmware downloaded 
over a cable television network. The integrity of the 
firmware is verfied and if valid, the firmware is ex- 
ecuted to provide one or more converter funtions. If 
the firmware is invalid, default operation software 
contained in ROM is executed instead of the firm- 
ware to return the converter to baseline operation. In 
one embodiment, the converter includes a frequency 
agile data receiver to receive control instructions on 



a first data channel and firmware on a second data 
channel. The receiver is forced back to the first 
channel if a successful firmware download does not 
occur on the second channel within a predetermined 
time period. The firmware is continuously transmit- 
ted in short segments, and the converter can con- 
tinue to receive segments until all the segments of a 
designated firmware package have been success- 
fully downloaded, unless the predetermined time lim- 
it expires sooner. 
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1. Claims 1-19: Cable television converter for receiving 

and verifying firmware downloaded from a headend and 
for using default software if the firmware is not 
verified. 

2. Claims 20-43: Cable television system for receiving 

firmware in response to addressable controldata 
from a headend. 

3. Claims 44-53: User terminal for securing and verifying 

segments of a firmware package and for determining 
if the package is complete. 
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